CVE-2023-5414 – This vulnerability in the Icegram Express WordP... (How to Fix)

Q: What is the severity of CVE-2023-5414?

CVE-2023-5414 has a CVSS score of 9.1 (CRITICAL). This vulnerability in the Icegram Express WordPress plugin allows administrator-level attackers to perform directory traversal attacks via the show_es_logs function. Attackers can read arbitrary files on the server, potentially accessing sensitive information from other sites in shared hosting environments. WordPress sites using vulnerable versions of the Icegram Express plugin are affected.

📋 TL;DR

This vulnerability in the Icegram Express WordPress plugin allows administrator-level attackers to perform directory traversal attacks via the show_es_logs function. Attackers can read arbitrary files on the server, potentially accessing sensitive information from other sites in shared hosting environments. WordPress sites using vulnerable versions of the Icegram Express plugin are affected.

💻 Affected Systems

Products:

Icegram Express (Email Subscribers) WordPress Plugin

Versions: Up to and including 5.6.23

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Requires administrator-level access to WordPress. Shared hosting environments are particularly vulnerable as files from other sites may be accessible.

📦 What is this software?

Icegram Express by Icegram

View all CVEs affecting Icegram Express →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Administrator-level attackers can read sensitive files including configuration files, database credentials, and files from other websites on shared hosting, leading to complete system compromise and data exfiltration.

🟠

Likely Case

Compromised administrator accounts can read sensitive server files, potentially accessing credentials and configuration data that could lead to further attacks.

🟢

If Mitigated

With proper access controls and file permissions, impact is limited to files accessible to the web server user, though sensitive information may still be exposed.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires administrator privileges. Public proof-of-concept code is available in vulnerability reports.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 5.6.24 and later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2977318%40email-subscribers%2Ftrunk&old=2972043%40email-subscribers%2Ftrunk&sfp_email=&sfph_mail=#file4

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Icegram Express' plugin. 4. Click 'Update Now' if available. 5. Alternatively, download version 5.6.24+ from WordPress repository and manually update.

🔧 Temporary Workarounds

Disable vulnerable function

all

Remove or disable the show_es_logs function in vulnerable plugin files

Edit class-email-subscribers-logs.php and comment out or remove the vulnerable show_es_logs function

Restrict file permissions

linux

Set strict file permissions to limit what the web server user can read

chmod 600 sensitive_config_files
chown root:root sensitive_files

🧯 If You Can't Patch

Remove administrator privileges from untrusted users
Implement web application firewall rules to block directory traversal patterns

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Installed Plugins for Icegram Express version. If version is 5.6.23 or lower, you are vulnerable.

Check Version:

wp plugin list --name='icegram-express' --field=version (if WP-CLI installed)

Verify Fix Applied:

After updating, verify plugin version shows 5.6.24 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual file access patterns in web server logs
Requests to plugin endpoints with ../ sequences
Access to files outside expected plugin directories

Network Indicators:

HTTP requests containing directory traversal sequences to plugin endpoints

SIEM Query:

web.url:*show_es_logs* AND web.url:*../*

📊 Metadata

CVE ID: CVE-2023-5414

CVSS v3 Score: 9.1 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CWE: CWE-22

Published: October 20, 2023

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-5414, you might also want to check these: